ClawHub
Back to skill

Security audit

Novel Writer Biling

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only Chinese novel-writing workflow skill with no evidence of hidden execution, credential use, network access, or destructive behavior.

Install this if you want a structured Chinese novel-writing assistant. Use a dedicated project folder for drafts and review proposed file creations or updates, especially if your manuscript or notes are private.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is broad enough to activate on many ordinary writing requests, which can cause the skill to intercept prompts outside a narrowly scoped novel-writing workflow. Over-broad routing increases the chance that users are pushed into this skill's prescriptive process or language/output constraints when they did not explicitly request it, creating prompt-scope confusion and reducing user control.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The usage examples are vague and permissive, such as routing from short user phrases directly into full workflow stages without confirming scope, format, or user intent. This can lead to unintended activation and overreach, especially when user requests are ambiguous or only partially related to fiction writing.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill metadata and content are written to operate in Chinese and imply Chinese-language output, but they do not state that the language should follow the user's preference. Forcing a language without opt-in can override user intent, degrade usability, and create prompt-routing conflicts when the user requested another language.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.